The Tenda AC6 router firmware 2.0/15.03.06.23 contains an OS command injection vulnerability identified as CVE-2026-8259. This vulnerability arises from improper handling of the lan.ip argument in a function related to the /goform/telnet endpoint of the embedded HTTP server (httpd). An attacker with high privileges can remotely inject and execute operating system commands, potentially compromising the device. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. No official remediation or patch has been disclosed, and the vendor has not provided advisory details. Exploit code has been publicly disclosed but no active exploitation has been confirmed.

Successful exploitation of this vulnerability allows remote OS command injection on the affected Tenda AC6 devices, potentially leading to unauthorized command execution and control over the device. This could impact device integrity and availability. However, exploitation requires high privileges, and the vulnerability has low vector complexity and no user interaction needed. There are no confirmed reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the device management interface and monitor for suspicious activity. Avoid exposing the device's management interface to untrusted networks. Follow vendor channels for updates on patches or official mitigations.